The goal of this test is to verify that admin can add ReCAPTCHA to the site log in page to add an extra layer of protection against user account brute force attacks and bot logins.

Requirements

• reCaptcha site key and reCaptcha secret key, follow https://www.google.com/recaptcha/about/ to get yours.
  • Please be noted that Moodle only supports v2 reCaptcha, so you will need to choose v2 instead of v3.
• You'll need admin access and another user (new or existing).

Setup, settings and and basic testing

1. As admin, navigate to Home and turn editing mode on.
2. Add the "Login" block to the side region.
3. Navigate to Site Administration > Plugins > Authentication > Manage authenticaton.
   • Verify that there's a setting called "Enable reCAPTCHA for login" (enableloginrecaptcha) in the Common settings section.
   • Verify that the default value is No.
4. Now set the "Enable reCAPTCHA for login" to Yes.
5. Make sure that the ReCAPTCHA site key and ReCAPTCHA secret key are blank.
6. Save changes and log out.
7. Navigate to the home page and click Log in link.
8. Verify that you will not see the reCaptcha element.
9. Verify that you can log in successfully.

Using ReCAPTCHA credentials to display the validation element

1. Login as admin and go the "Manage authentication" page again.
2. Fill in the ReCAPTCHA site key and ReCAPTCHA secret key.
3. Save changes and log out.
4. Navigate to the home page and click Log in link.
5. Verify that you will see the reCaptcha element.
6. Fill in the username and password and leave the reCaptcha as is.
7. Click the Login button.
8. Verify that you cannot log in.
9. Verify that you will see a message: Failed reCAPTCHA challenge, try again.
10. Fill in the username and password again.
11. Click on the reCaptcha and try to solve it. (Until you get the green tick).
12. Click the Login button and verify that you can log in successfully.

Password change should not display captcha element

1. Login as admin and navigate to Site Administration > Users > Browse list of users
2. Click on the "Edit" icon for a user and check the "Force password change" checkbox.
3. Click the Update profile button.
4. Logout and login as the user.
5. Verify that you will see the Password change page.
6. Verify that you can change the password normally.
7. Logout.

Captcha element can be used in the "Login" block

1. Navigate to the home page and expand the block drawer.
2. Verify that you will see the Login block.
3. Verify that you will see the reCaptcha element in compact mode (Smaller than normal).
4. Fill in the username and password and leave the reCaptcha as is.
5. Click the Login button.
6. Verify that you cannot log in.
7. Verify that you will see a message: Failed reCAPTCHA challenge, try again.
8. Fill in the username and password again.
9. Click on the reCaptcha and try to solve it. (Until you get the green tick).
10. Click the Login button.
11. Verify that you can log in successfully.

Disabling reCAPTCHA

1. As admin, navigate to Site Administration -> Plugins -> Authentication -> Manage authenticaton.
2. Set the "Enable reCAPTCHA for login" to No.
3. Save changes and log out.
4. Navigate to the home page and click Log in link.
5. Verify that you will not see the reCaptcha element.
6. Verify that you can log in successfully.